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8 Septeambar 1975 


MEMORANDUM FOR: Members of the Privacy Act Working Group 


SUBJECT : Requirements foc System Managers 


Herewith is a revised summary of Privacy Act rvequiraments 
for record system(s) managers as discussed at the lust Working 
Group session held on 4 September 1975. The purpose of the 
paper is to set forth general guidelines to be used ly vecord 
system managers in developing and documenting procedures ¢ 
implament the provisions of the Act. Although these vaquire- 
ments will be included in tue Agency Privacy Act vesulations 


‘now betng drafted, I suggest tnat this paper b2 tesued as a 


formal working guide to all components that maiutoin record 


‘systems subject to the Act. i would, therefore, appreciate 


receiving your comments and suggestions, etc., by close of 
business on 10 Septembar 1975. 


ert, 
Privacy Act Worling Group . 


Att 


we 
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PRIVACY ACT REQULLEMENTS 
FOR SYSTEMS MANACERS 


Anaally voovida osiiea to the publte with the Faceral Te.yisuae of 
the wxL3sLeace ao character of auch avacem ul ctecuris onutatained 
by any agency which contains intormatton ca zinizens of the United 
States sad aliens admitted for parnaneat vesideaca (uerteafter 
referred 2») cs individuals) chat js vretcieved by individual name 
or unique identifier such as a social security number ot other 
agency assigned reference u:nber. 

a. The purpose of the notics is to provide individuals with 
sufficient information sbout records systems ts: snable the 
individual to make a determination if system of <acords may 
contain information about him. Moreover, tha uctice must 
define the purpose for which the records area malitained and 
the iutended (iseacoe the iuformation and who or vhat 
agencies have access to the records. The statenent of 
uses (hereafter referred =o as routine uses) ard the 
usecs is to inform indtvicuals what the inforsation is 
used for and the authorised dissemination of indistdual 
Tecorcds to other agencies. 

b. Any use or dissemination of information about ea individual 
which ts not provided for under the provision ef the Act 
covering Conditions of Disclosure (Section 3, subsection (b)) 


requires the written consent of the individual prior to the 


oW 


- 
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use or disclosure of the information. Following is a summary 


of thé Conditions of Disclosure which constitute the criteria 
for use or disclosure of individual information when written 
_consent of the individual is not required: 

(1) For disclosure to employees of the agency which main- 
tains the record who have a need for the record in the 
performance of their required duties; 

(2) For dtecinetes which are required under the Freedom 
of Information Act; | 

(3) For disclosures mede for a routine use as defined in 
the notice of records systems published in the Yederal 

errr. 

(4) For disclosures mede to the Bureau of Census; 

(5) For disclosures to a person or another agency for 
statistical reseerch or reporting purposes; 

(6) For disclosures to the National Archives; 

(7) For disclosures for « law enforcement activity provided 
the head of the egency or instrumentality has made 
written request tc CIA, 

(E)} For disclosures upon 2 showing of "compeiiing efreum- 


stences" 


affecting the bealth or satety cf an individual: 
(©) Por disclosures: te the Congress or the Comptroller Generel: 


(10} For disclosures: pursuant to a court order. 
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Sep Report phe Eieapt' 1657 BIOES CidoRDeslsodoombeqgene1 0664 of 
Management and Budget, and Congress whenever a new systam is 
established and before changes to existin ug systems are effactive. 
(See paragraph 3 for definition of changes to existing byacens.) 

3, Public notice «ust be given in the Fadaral Register for a period of 
not less than 50 days before a new system or changes to existing 
systems becowe operative. 

a. Change to au existing system is datiaed as any new use or 
alteration tn the system Capability which has ence eas os 
expanding the availability of tutfocmation in the System, 4.3.3 
(1) any change in a routine use: 

(2) an expansion of: 
(a) the categories of records maintained, 
(b) the categories of individuals on whom 
records are maintained, and 
(c) the dissemination of the information; 
(3) Alteration of the way the system operates or ics location(s) 
in a way that the process by which individuals can -zain 


access to, or request changes in, records is changed; 


(4) Chang2 of the equipment continnuration in a way ¢: it creates 
Otential for greater access, e.e., if adda tele. umuntieations 
3 


capability. 
B. DISCLOSURE REQUIREMENTS 
1. Disclosure of individual information may be made without wWoitcen consent 
of the individual concerned only if the information falls within the 
conditions of disclosure defined under Section 3, subsection (b) of the 
Act (see Notice Requirements, paragraph A.(1)b.). 


a. System Managers must develop and document procedures that: 


(1) control dissemination in accordance with conditions of dis 
3 


sclosure; 
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(2) ensure that no-information is disclosed that falls 


‘outside the conditions of disclosure without obtaining 
prior consent of the individual concerned; 
(3) establish safeguards to protect dita from unauthorized 
alteration; and 
(4) examine vecocds prior to authorises disclosure to ensure 
that infeimazion is aceurate and relevant to the redecot. 
C. ACCOUNTING REQUIREMENTS 2 ¢ 
i. ystems Managers wust maintain an accenotine eX disclosures of rj: 
individual record except disclosures meade io Agency personnel «:.J 
those made under the Freedom of Information Act, as amended. Tre 
accounting must inciude the following infecrattoa: 
a. The date, purpose and a listing of the recerd(s) disclosed. 
b. The name and add-esse of the person or agency to whom the 
disclosure was disclosed. 
2. The purpose of the accounting is threefoid: 
a. To inform the individual who asks: where, to whom and the 
purpose of the disclosure. 
b. To ensure: that disclosures are competille with stated uses 
and users published in the notice of record system publiected 
in the Federal Rerister, 
c. To inform tbe recipients of gpferrcitsy fother agencie::) 
when a record (2) wndeh has been previvusty dfselosed tes: 
doen @vaaded wr whea where tes disperse betveen the agene y 
of record ani ihe sndividee] eoce rary the aeeeracy of the 


record. 


. 
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D. INDIVIDUAL ACCESS REQUIREMENTS 
1. The Act provides for an individual to have access to records on 
hin which are maintained by the Agency except those records which 
have been exempted: 

«. Polygraph records. 

b, Portions of recor’s which would reveal intelligence sources 
end methods. 

ec. Records or inforwation provided by forelpn. Yederal, state 
or other public es-n-cies or authorities. 

d. Kecords which mect «: emption criteria as established in 
Section 3, subseccics (xk). Following is a suwemary of these 
‘exemptions: 

(1) Documents properly classified in accordance with 
Executive Ordex 116523 — 

(2) Investigatory material compiled for lew enforcement 
purposes; 

(3) Records maintained in connection with providing 
protective cervices to the Presidert of the United 
States; 

(45 Recerds reondrid by statute to be wetyratned and used 
solely as gi. tistteal records; 

(83 Tevesifveror revo rectal comp ited ootele foes vhe purge: 
of determin, suftability, cfieth’}ics, or eusliti- 
eadtions tea Vecorul oiviltaw eoshe sooty wil itary 
service, tecric. centracts, or evcess ru classified 


information, tit culy toe the extent ihet disclosura 
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of such material. would reveal the identity of a source 
who furnished information to the Government under an 
express promise that the identity of the source would be 
held in confidence, or, prior to the effective date of the 
Act, 27 September 1975, under an implied promise that the 


identity of the seurce would be held in acnfidence3 


oN 
oN 
vw 


Testing or excinarion material used valely to determine 
individual qu:iifications for appotnimcny or promotion in 
the Federal sexvice the disclosure of which would compro- 
mise the objectivity of fairness of ite vesting or exami- 
nation process; 

(7). Evaluation material used to determine potential for pro- 


motion in the Armed Services. 


E. SEARCH YOU LREMENTS 


1. 


The Information Review Staff will forward individual requests to 
fyeiens Managers who shall be reseoneibié for cevemnining if the 
record system(s) contains information on the individual. 

ce System Manager sheii report to the Information Review Staff: 
uw. the fact that a record search has been performed; 

be cepies of all records found in the search: that are releasable; 


and 


an explenatory statement recommending exemption of records or 


a 


portions thereof when, in the judgment of the System Manager, 
the information meats the exemption criteria as defined in 


paragraph D, above. 
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1. The Information Review Staff will forward requests to amend an 
individual record to the sopropeiaba System Manager who shall make 
a determination to amend or not +o amend the tndividial rccord. 
a. The Sysceum Manager shall: 

(1) Avaed the individual recocd uceording to esiLabitinad 

| peowedures; and 

! (2) Noticy all recipients of infowmation previnu3ty 
disseminated on the individual of the amendnect: 

or, if » decision is made wok to amend the record: 

(3) Prorare a statement fox forwarding to the iudividual the 
reasons why the amendment should not be effeciet, and 
forward it to the farotutian Review Stafi. 

(4) Such statement shall be written and process: so that 
the Information Review Staff can teapond t te the individual - 
guguentey within 10 working days of the reccirt of amend- 
ment eacuese by the Agenty. 


G. MANAGEMENT CTs 'STICS/REPORTING RR 


Effective 25 Saptember 1975, each Systems Manager shall bz responsible 
for reportin., «. a weekly basis co cine Information Revi. “Luff, the 


following ini: ation: 
1. Professional /eclerical man-houss devoted to: 
a. Implementing the Privacy Act 
b. Processing Privacy Act request 
2. Cost of additional equipment/hardware to implement the Act. 


3. Cost of additional forms or forms modifications. 
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